Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

Why this deserves its current priority

CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Ajax Load More (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Ajax Load More.
2. 2Review the reported fix. Update Unknown/Ajax Load More to 8.0.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 5, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 26, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 5, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order_by' ParameterAlso CWE-89
• Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' ParameterAlso CWE-89
• WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' ParameterAlso CWE-89
• GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' ParameterAlso CWE-89
• OpenPanel SQL Injection via ClickHouse Property Key FilterAlso CWE-89
• Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' ParameterAlso CWE-89